Residual risk

Category: Risk management frameworks · Reviewed by Al Jabbar, Broker · Specialist Risks · Last reviewed

Residual risk

Residual risk is the level of risk remaining after controls and treatments have been applied. It is the rating against which a firm’s risk appetite is actually assessed: appetite statements that compare appetite to inherent risk are almost always meaningless.

The relationship

Inherent risk − effect of controls = Residual risk

If residual exceeds appetite, the firm must add controls, transfer the risk (e.g. via insurance), avoid the activity or formally accept the excess.

Insurance as a residual risk treatment

For commercial clients, insurance is one of the principal levers for reducing residual risk to a board-acceptable level. When evaluating a programme, brokers should ask:

• What residual risk position is the insured trying to achieve (a per-event cap, an aggregate cap, a probability-weighted reduction)?
• Does the programme (retention + limit + coverage) actually deliver that position?
• What residual risk remains after insurance (uninsured perils, retention, sub-limits, exclusions, counterparty credit risk on the reinsurer)?

References

• ISO 31000:2018, Clause 6.5.
• ISO Guide 73:2009.
• COSO (2017) ERM Framework.

Cross-references

• Inherent risk
• Risk treatment
• Risk transfer
• Risk acceptance

Maintained by Matt Bartlett, Director, Apex Insurance Brokers Limited. FCA FRN 724952. Companies House 07014570.